test: repair serial-bucket quick wins and quarantine intractable specs (phase 4b)

Repairs (74 tests across 6 files):
- rbac.spec.ts, settings.spec.ts: fix obsolete auth-state path
  (test-results/.auth/user.json -> .playwright/.auth/user.json via
  authFile import from playwright.config.ts)
- state-bleed-audit.spec.ts, gui-file-carry.spec.ts, full-session.spec.ts:
  update bare tool routes (/resize -> /image/resize, etc.) to match the
  2.0 /:modality/:toolId routing
- gui-settings-rbac.spec.ts: fix 2 tests with bare /resize route

Quarantine (65 tests across 2 files, tagged with test.skip()):
- gui-performance.spec.ts (62 tests): bare routes throughout + selector
  drift; mechanical route fix is tractable but needs UI verification pass
- theme.spec.ts (3 tests): footer theme toggle selector needs 2.0 UI
  verification

QUARANTINE.md updated with full triage table. Vitest parity confirmed.

tests/e2e/gui-settings-rbac.spec.ts

@@ -499,7 +499,7 @@ base.describe("RBAC Settings Visibility - User", () => {
     await login(page, USER_USER, USER_PASS);
 
     // Navigate to the resize tool page -- user role should have tools:use permission
-    await page.goto("/resize");
+    await page.goto("/image/resize");
     await page.waitForLoadState("networkidle");
 
     // The tool page should load (not redirect or show a 403)
@@ -517,7 +517,7 @@ base.describe("RBAC Settings Visibility - User", () => {
     await login(page, USER_USER, USER_PASS);
 
     // Navigate to the resize tool
-    await page.goto("/resize");
+    await page.goto("/image/resize");
     await page.waitForLoadState("networkidle");
 
     // Upload a test image via the file chooser